CVE-2022-49231
Description
A flaw was found in the Linux kernel's rtw88 driver. This issue occurs due to insufficient memory allocation during hardware scans, which can lead to a buffer overwrite. A local attacker could exploit this memory corruption vulnerability to trigger access violation faults and memory leaks, potentially causing a denial of service.
Statement
A moderate severity flaw was found in the Linux kernel's rtw88 wireless LAN driver, which ships in Red Hat Enterprise Linux 9. During a hardware scan, the driver allocated a buffer smaller than the amount of data actually written, so the overwrite caused the memory-management subsystem to raise access violation faults; early-return paths in the scan flow could also leak memory. A local attacker able to trigger a hardware scan on a system with affected Realtek rtw88 wireless hardware could use this memory corruption to crash the kernel, causing a denial of service. Red Hat rates this flaw CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the evidence supports availability impact only; this differs from the CVEORG score of 7.8, which assumes high confidentiality and integrity impact that the nature of the flaw does not establish. The kernel and kernel-rt components in Red Hat Enterprise Linux 9 are affected, and the fix has been deferred given the moderate, availability-only impact that requires local privileges to exploit; until a fix is delivered, the residual risk is local denial of service on systems using rtw88 wireless hardware. Red Hat Enterprise Linux 6 and 10 and Red Hat In-Vehicle OS (where the vulnerable code is not present) are not affected, and the listed Red Hat Enterprise Linux 7 and 8 update streams are out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advantage of other unexpected program behavior resulting from a low memory condition.
Other
Technical Impact: Reduce Performance
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
